luci-base: don't propagate null bytes in path information

[project/luci.git] / modules / luci-base / luasrc / dispatcher.lua

diff --git a/modules/luci-base/luasrc/dispatcher.lua b/modules/luci-base/luasrc/dispatcher.lua
index e4f77f1..fc497ca 100644 (file)
--- a/modules/luci-base/luasrc/dispatcher.lua
+++ b/modules/luci-base/luasrc/dispatcher.lua
@@ -113,7 +113,8 @@ function httpdispatch(request, prefix)
                end
        end
 
-       for node in pathinfo:gmatch("[^/]+") do
+       local node
+       for node in pathinfo:gmatch("[^/%z]+") do
                r[#r+1] = node
        end
 
@@ -136,8 +137,7 @@ local function require_post_security(target)
 
                                if (type(required_val) == "string" and
                                    request_val ~= required_val) or
-                                  (required_val == true and
-                                   (request_val == nil or request_val == ""))
+                                  (required_val == true and request_val == nil)
                                then
                                        return false
                                end
@@ -191,6 +191,9 @@ local function session_setup(user, pass, allowed_users)
                        timeout  = tonumber(luci.config.sauth.sessiontime)
                })
 
+               local rp = context.requestpath
+                       and table.concat(context.requestpath, "/") or ""
+
                if type(login) == "table" and
                   type(login.ubus_rpc_session) == "string"
                then
@@ -199,8 +202,14 @@ local function session_setup(user, pass, allowed_users)
                                values = { token = sys.uniqueid(16) }
                        })
 
+                       io.stderr:write("luci: accepted login on /%s for %s from %s\n"
+                               %{ rp, user, http.getenv("REMOTE_ADDR") or "?" })
+
                        return session_retrieve(login.ubus_rpc_session)
                end
+
+               io.stderr:write("luci: failed login on /%s for %s from %s\n"
+                       %{ rp, user, http.getenv("REMOTE_ADDR") or "?" })
        end
 
        return nil, nil
@@ -337,15 +346,23 @@ function dispatch(request)
                   ifattr      = function(...) return _ifattr(...) end;
                   attr        = function(...) return _ifattr(true, ...) end;
                   url         = build_url;
-               }, {__index=function(table, key)
+               }, {__index=function(tbl, key)
                        if key == "controller" then
                                return build_url()
                        elseif key == "REQUEST_URI" then
                                return build_url(unpack(ctx.requestpath))
+                       elseif key == "FULL_REQUEST_URI" then
+                               local url = { http.getenv("SCRIPT_NAME"), http.getenv("PATH_INFO") }
+                               local query = http.getenv("QUERY_STRING")
+                               if query and #query > 0 then
+                                       url[#url+1] = "?"
+                                       url[#url+1] = query
+                               end
+                               return table.concat(url, "")
                        elseif key == "token" then
                                return ctx.authtoken
                        else
-                               return rawget(table, key) or _G[key]
+                               return rawget(tbl, key) or _G[key]
                        end
                end})
        end
@@ -358,7 +375,7 @@ function dispatch(request)
                "https://github.com/openwrt/luci/issues"
        )
 
-       if track.sysauth then
+       if track.sysauth and not ctx.authsession then
                local authen = track.sysauth_authenticator
                local _, sid, sdat, default_user, allowed_users
 
@@ -641,6 +658,23 @@ function node(...)
        return c
 end
 
+function lookup(...)
+       local i, path = nil, {}
+       for i = 1, select('#', ...) do
+               local name, arg = nil, tostring(select(i, ...))
+               for name in arg:gmatch("[^/]+") do
+                       path[#path+1] = name
+               end
+       end
+
+       for i = #path, 1, -1 do
+               local node = context.treecache[table.concat(path, ".", 1, i)]
+               if node and (i == #path or node.leaf) then
+                       return node, build_url(unpack(path))
+               end
+       end
+end
+
 function _create_node(path)
        if #path == 0 then
                return context.tree
@@ -782,7 +816,16 @@ local function _cbi(self, ...)
 
        local state = nil
 
+       local i, res
        for i, res in ipairs(maps) do
+               if util.instanceof(res, cbi.SimpleForm) then
+                       io.stderr:write("Model %s returns SimpleForm but is dispatched via cbi(),\n"
+                               % self.model)
+
+                       io.stderr:write("please change %s to use the form() action instead.\n"
+                               % table.concat(context.request, "/"))
+               end
+
                res.flow = config
                local cstate = res:parse()
                if cstate and (not state or cstate < state) then
@@ -875,7 +918,7 @@ end
 function cbi(model, config)
        return {
                type = "cbi",
-               post = { ["cbi.submit"] = "1" },
+               post = { ["cbi.submit"] = true },
                config = config,
                model = model,
                target = _cbi
@@ -903,6 +946,7 @@ local function _form(self, ...)
        local maps = luci.cbi.load(self.model, ...)
        local state = nil
 
+       local i, res
        for i, res in ipairs(maps) do
                local cstate = res:parse()
                if cstate and (not state or cstate < state) then
@@ -921,7 +965,7 @@ end
 function form(model)
        return {
                type = "cbi",
-               post = { ["cbi.submit"] = "1" },
+               post = { ["cbi.submit"] = true },
                model = model,
                target = _form
        }